Privacy Policy

Last updated: 31 October 2026

In short

No account, e-mail or phone number. You pick a nickname and an avatar and play.
No ads, no tracking, no profiling. We do not sell your data.
Drawings, chat and guesses only go to the players in your room during the game; they are not stored.
Your IP address is kept in server logs for a short time (7–14 days) for security.
If the computer players (bots) cannot make out a human's drawing, an image of the drawing (without your name or chat) may be sent to a cloud vision service.

1. Who is responsible, and how to reach us

PenGuess (penguess.io) is a multiplayer draw-and-guess game for the web, iOS and Android. This policy covers the game (play.penguess.io and the mobile apps) and this website. For any privacy question or request: [email protected].

2. What we process and why

Nickname, avatar and language: So you can play and other players can see you. You don't have to use your real name, and we suggest you don't. Kept only in the server's memory and deleted when you leave the room and the reconnect window ends.
Session key: A random key that lets you return to your game with your score after a dropped connection. Stored on your device and in the server's memory; it says nothing about who you are.
Drawings, chat messages and guesses: The game itself: sent to the players in your room. The server keeps them in memory only while the turn and the room last, and deletes them when the room closes. They are never written to a database or a log file. Profanity is masked automatically.
Reports and kick votes: To keep the rules. Kept in memory for that turn or room only; a player who is kicked cannot rejoin that room for a short while.
Technical connection data: IP address, time and type of connection, app version. To prevent abuse (rate limits, attack protection) and to fix errors. Kept for at most 7 days in the game server's logs and at most 14 days in the web server's access logs, then deleted automatically.
Stored on your device: Your profile (nickname, avatar, language), the session key, whether you accepted the rules, and your sound settings stay on your device, in the app's or browser's storage. Delete the app or clear your browser data to remove them.

We collect nothing else: no location, contacts, camera or microphone access, and the apps contain no advertising or analytics libraries.

3. Computer players (bots)

Chat: bots answer with a language model that runs on our own server. What you write to them is not sent to any third party.
Seeing drawings: when a human draws and the bots cannot make it out, or to check whether someone wrote words instead of drawing, a small image of the canvas may be sent to a cloud vision service (currently Anthropic, Claude). Only candidate words from the game's word list go with it — never your name, your chat or your IP address. We do not keep the image. Anthropic processes it under its own privacy policy.

4. Service providers and transfers abroad

We do not sell your data or share it for advertising. To run the game we work with:

Hostinger: hosting of the game server (European Union, France) — privacy policy.
Cloudflare: domain, network and attack protection, plus cookie-free aggregate visit statistics that do not identify you (Cloudflare Web Analytics) — privacy policy.
Anthropic: the bots' drawing recognition (see above) — privacy policy.
Apple App Store and Google Play: when you download the app, the stores process data under their own policies.

These providers may process data outside your country (including the European Union and the United States). We transfer only what is needed to run the game, relying on the safeguards these providers offer.

5. Cookies

The game and this site use no advertising or tracking cookies — only the device storage the game needs to work (see above). Cloudflare may set strictly necessary technical cookies to protect against attacks.

6. Legal basis

We process data to provide the game you asked for (GDPR Art. 6(1)(b); Turkish KVKK Art. 5(2)(c)) and for our legitimate interest in keeping it safe and free of abuse (GDPR Art. 6(1)(f); KVKK Art. 5(2)(f)).

7. Your rights

Under the GDPR and the Turkish Personal Data Protection Law (KVKK, Art. 11) you can ask whether we process your data, get a copy, have it corrected or deleted, object to processing and lodge a complaint. Write to [email protected]; we answer within 30 days. Because we keep no accounts, we can only match data to you with details you give us (for example when you played and your IP address). You can also complain to your local data protection authority or to the Turkish Personal Data Protection Authority.

8. Children

PenGuess is suitable for all ages and asks for no account or personal details. We recommend that children under 13 play with a parent's guidance and don't use their real name as a nickname. We do not knowingly collect personal data from children; if you think we have, write to us and we will delete it.

9. Changes

When the game gets new features (for example accounts or leaderboards) we update this policy. The current version is always on this page, with the date at the top.